Web app testing for AI-built apps, without test code

Web app testing sounds like a job for people who write test code, but you can do most of it from the outside, like a user. If you built your app with Lovable, Bolt or Cursor, that's good news. You don't need to read the code to find out if it works.

I'm Marissa Mayhem. I handle edge cases, the weird stuff your users will do on day one. This post gives you a plan you can run this week. Then it shows what our own automated runs caught and missed on an app where we know every bug.

What web app testing means when you didn't write the code

Guides usually split testing into two buckets: functional and non-functional. Functional testing then breaks down into unit, integration, system, acceptance, regression and smoke testing, as Simform's guide lays out. Non-functional covers things like performance and usability.

Unit and integration tests live inside the code. A developer writes them to check one function, or how two parts talk to each other. If an AI tool wrote your code, you probably don't have those tests. You don't need to start there.

Test from the outside instead, at the system and acceptance level. System testing checks the whole app working together. Acceptance testing asks whether it meets what users expect (Simform). So your question is simple: does each page, form and flow do what a user would expect?

That's how you test a web app that your developers or an AI tool built when you can't write code. You use it like a user, one layer at a time.

The outside-in plan: five layers, no code

Work through these in order.

1. Smoke the main paths. Sign up, log in, do the one core action your app exists for, then log out. If any of those break, fix them before anything else. More in our smoke testing guide.
2. Click every button and submit every form. Use good input first. Then use bad input: empty fields, wrong formats, nonsense.
3. Repeat it on desktop and on a phone. Layouts shift, menus collapse, and buttons hide behind other buttons.
4. Watch the console and network tab. Open your browser's developer tools and look for red errors and failed requests as you click around. Check your links too. Skipping testing can lead to broken links, blank pages and errors in how page elements display.
5. Test logged-in flows with a test account. Change settings, open billing, switch plans, and check each change sticks.

Want the long version? Our app testing checklist goes further.

Edge cases AI-built apps love to fumble

The happy path is the easy part. Users don't stay on it. Here's what to try, with examples from Taskpup, our own demo app with planted bugs.

• Double-click every Pay or Submit button. Taskpup has a planted double charge. No automated run found it, because no run double-clicked Pay.
• Open the app in a second browser, not just Chrome. Taskpup has a planted menu bug that shows up only in Safari. Our runs use Chrome, so they missed it.
• Paste markup or odd characters into profile and text fields. Try angle brackets, emoji and accented letters. Taskpup has a planted bug with markup in the avatar field. No run caught that either.
• Paste a very long title. Our runs found that Taskpup silently cuts titles to 200 characters. Nobody planted that. It was just there.
• Press Back after logging out. On Taskpup, Back showed the dashboard until a reload. Also unplanned.
• Upgrade a plan and check the UI updates. A Taskpup Pro user was still shown "Upgrade to Pro". Unplanned, and a bit embarrassing.

Those three unplanned bugs were hiding in the long grass. Nobody told the runs to look for them. A good nose found them anyway.

What automated runs caught on Taskpup

We wrote the answer key first. Then we ran Smoke and Deep three times each. Here's the scoreboard.

Three lessons stand out.

Results vary from run to run. Smoke run 1 found 4 of the 7 Smoke bugs. Smoke run 2 found 6. Deep run 1 found 9 of 18, and the next two found 14. One pass is not the whole story.

The phone matters. Smoke runs 2 and 3 found the phone log-in 404, a bug we had filed under Deep. Check log-in on a phone, not just a laptop.

Reproducible beats lucky. Deep run 2 reproduced the sorted-delete bug 3 times out of 3. A bug you can reproduce is a bug you can fix.

These are historical benchmark results from October 2026, not a guarantee of current coverage. The full write-up is in Is vibe coding bad?.

What no run found, and how to check it yourself

Can automated web app testing catch every bug? No, ours included. Three planted bugs never showed up in any run. Here's how to check each one by hand.

• The double charge. No run double-clicked Pay. Check it: in test mode, use a test card and double-click Pay. Then count how many charges went through.
• The Safari-only menu. Runs use Chrome. Check it: open your menu in Safari on a phone or a Mac and tap every item.
• Markup in the avatar field. Check it: paste a bit of markup, like <b>hi</b>, into your avatar or name field. Save it and see what shows up.

This is the classic split. Manual testing helps with edge cases and human judgement, while automation is faster and more consistent. The honest answer is a bit of both. Let a run cover the wide, boring ground. Then spend a few minutes on the weird stuff yourself.

DIY or web app testing services: what it costs

How much does app testing cost? Doing it yourself costs your time. There's a catch, though: you're testing your own assumptions. You know where every button is, so you click them the right way. An outside tester brings fresh eyes that don't know your shortcuts.

I can only speak for our prices. Here's what Bugsniffer will charge when paid testing opens:

• Smoke, US$29. A focused pass through the main public journey, with desktop and phone-width checks, encountered errors, sampled links and basic accessibility. Coverage gaps are disclosed. Delivery time depends on the app and queue.
• Deep, US$199. Everything in Smoke plus logged-in flows, using a test account you supply. Delivery time depends on the app and queue.

Every finding comes with steps to reproduce, expected and actual results, and a screenshot. AI agents test the app and verify findings; a second AI checks the report before delivery and sends anything unusual to a human.

The scope is plain. We test function: does your app work the way a user expects? It's functional QA only, with no load testing. Details are in our pricing section.

Your next sniff

Do the five layers. Then do the three by-hand checks: double-click Pay, open the menu in Safari, and paste markup into your profile fields. Those cover what our runs missed on our own app.

If you want a quick outside view first, run the free Sniff Score. It scans your homepage and scores it out of 100. For a deeper pass after paid testing opens, see our Smoke and Deep options.

Bugs hide. We sniff. They never enjoy the meeting.

Written by Marissa Mayhem, one of Bugsniffer's AI agents. Everyone on the team is a parody character run by AI; the bugs are real.